1

My desktop is in the living room where anyone visiting can access it. I'd like to make it secure from those in my home since I have a roommate.

Improve this question
2
  • 3
    Lock the screen everytime you leave it or do you need other security - note that physical access to the mac will allow complete access if they reboot it to sing;e user mode
    – mmmmmm
    Commented Feb 10, 2016 at 16:37
  • @Mark Which can easily be prevented.
    – bot47
    Commented Feb 10, 2016 at 19:31

2 Answers 2

Reset to default
3

You can't make it truly secure; there is a saying that says given enough time, physical access is root access. That being said, there are some steps you can take to get as close as possible.

FileVault

Enable filevalult. This will keep people from accessing your data if they boot from an external drive. To do this, go to System Preferences -> Security & Privacy -> FileVault, and click Turn On FileVault. This will most likely require an admin password, and will probably take a very long time, depending on how much stuff is on your computer. That being said, it's worth it.

Screen lock

Enable auto-locking of your computer after a set amount of time. This can be done in System Preferences -> Security & Privacy -> General. Check the box that says require password [5 minutes] after sleep or screensaver begins and change it to your desired amount of time.

Firmware lock

To prevent booting into single user mode or from an external disk without a password, enable firmware lock.

WARNING: THIS IS VERY HARD TO RECOVER FROM IF YOU LOSE YOUR PASSWORD. DON'T LOSE IT.

To do this, shut down your computer and turn it on while holding the Command+R keys. This will put you in recovery mode. Click the Utilities menu, and select the Firmware Password Utility. Click Turn On Firmware Password... and set a password. You will need it to boot from anything other than your main partition, so keep it safe! If you have an older Mac (Pre-2011, I think) there is a trick to get around this, but it requires removing the RAM, so it's pretty unlikely.

Improve this answer
0

There's never a way to make it entirely secure, especially with physical access. However, you can significantly increase the difficulty.

I would recommend following this guide by hardentheworld.org to harden OS X. It's pretty long, but I'll list the steps quickly here: bold is more important.

  • Allow only signed apps
  • Check Privacy permissions
  • Destroy FileVault Keys
  • Disable Bonjour
  • Disable Creation of Metadata Files
  • Disable Diagnostics
  • Disable Guest user
  • Disable Handoff
  • Disable password hints
  • Disable recent items
  • Disable Spotlight localization
  • Disable Spotlight Suggestions
  • Enable FileVault
  • Enable Firewall
  • Enable screen saver
  • Empty trash securely
  • Erase free space
  • Power off memory during standby
  • Require an administration password
  • Require password to un-lock
  • Save to Disk by Default
  • Set a Firmware Password
  • Show all filename extensions
  • Show when localization is used
  • Users privilege separation

In addition, I'd recommend the following:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .